Repository navigation
P0 §5.1 Phase-2: provenance-key the shell-literal guard emit-side (fail-open to fail-closed) - #5776
Merged
Merged
Conversation
…il-closed) Mirror the check-side's call-target provenance on the emit-side: - Add emit_side_provenance_walk + emit_side_provenance_scan_function to medium_structure_project.rs — detects string literal args passed to emitted_medium_emit_fns (direct or 1-hop let-bound), regardless of markers - Expand emitted_medium_emit_fns with toolchain_provision_shell_exec, autoinstall_user_data, install_server_dnsmasq_conf - Roster srv3_os_install_emit_test.dag + srv3_install_server_emit_test.dag (newly caught on check-side by the expanded emit-fn set) - Add planted_provenance_leak_markerfree to plant.dag: calls ci_yml_drifted with "git add && git commit" — no markers, caught only by provenance - Update planted_leak_test.dag count 3→4 - Remove HONESTY fail-open note from construction_justification Green by execution: medium_structure_planted_leak_detected_holds=true (count==4) + medium_structure_clean_tree_holds=true (canonical corpus clean) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This was referenced Jun 25, 2026
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…gin/main) main_wet regressed accurate LANDED Phase A content back to stale .dag prose. Not my lane — neat-boar owns this drift. Restore to origin/main's correct version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both additive: main added serialize_html_source/serialize_fragment emit fns + planted_html_check_side_leak (check-side); this branch adds shell provenance emit fns + planted_provenance_leak_markerfree. Combined: 5 planted leaks. Rationale updated to incorporate Html specifics + drop stale "arrives in a later PR" sentence (Phase-2 now landed). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Converts the emit-side
InlineSyntaxLiteralface ofmedium_structure_containmentfrom marker-sampled (fail-open) to provenance-keyed (fail-closed): a string literal authored as an arg to anemitted_medium_emit_fnis now caught regardless of whether it contains#!/or>/dev/null. Mirrors the check-side's existing call-target provenance architecture. Also expands the emit-fn set to cover shell provisioning functions (toolchain_provision_shell_exec,autoinstall_user_data,install_server_dnsmasq_conf) and registers the two newly-caught provision test files on the exception roster.Changes
medium_structure_project.rs: addsemit_side_provenance_walk+emit_side_provenance_scan_function(string-literal-arg detection over emit fn call sites, 1-hop let-bound included); hooks them intomedium_structure_leak_factsalongside the existing marker scanmedium_structure_containment.dag: adds 3 emit fns toemitted_medium_emit_fns; addssrv3_os_install_emit_test.dag+srv3_install_server_emit_test.dagto the exception roster (newly caught by check-side after fn expansion); removes the HONESTY fail-open note fromconstruction_justificationplant.dag: addsplanted_provenance_leak_markerfree— callsci_yml_drifted(committed: "git add && git commit"), caught by provenance, zero markersplanted_leak_test.dag: count 3→4Test plan
gunbc run ... --function medium_structure_planted_leak_detected_holds --claim-run→true(count==4, including the new marker-less planted case)gunbc run ... --function medium_structure_clean_tree_holds --claim-run→true(canonical corpus count==0)discriminators_test.dag) →truecargo build -p v1-compiler(Rust compile) → clean